What is CVE-2026-25166?

CVE-2026-25166 is a security advisory published by Microsoft Security Response Center (MSRC) with High severity. Windows System Image Manager Assessment and Deployment Kit (ADK) Remote Code Execution Vulnerability

Which CVE IDs does CVE-2026-25166 cover?

CVE-2026-25166 covers the following CVE IDs: CVE-2026-25166. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of CVE-2026-25166?

CVE-2026-25166 has a CVSS v3 base score of 7.8, published by Microsoft Security Response Center (MSRC).

Which products are affected by CVE-2026-25166?

CVE-2026-25166 affects 5 products, including: Windows ADK for Windows 10, version 2004; Windows ADK for Windows 11, version 22H2; Windows ADK for Windows 11, version 23H2; Windows ADK for Windows 11, version 24H2; Windows ADK for Windows Server 2022.

CVE-2026-25166HighCVSS 7.8

Windows System Image Manager Assessment and Deployment Kit (ADK) Remote Code Execution Vulnerability

Vendor

Microsoft Security Response Center (MSRC)

Published

May 31, 2026

Last Modified

—

🔗 CVE IDs covered (1)

CVE-2026-25166 →

📋 Description

Deserialization of untrusted data in Windows System Image Manager allows an authorized attacker to execute code locally.

🎯 Affected products5

Windows ADK for Windows 10, version 2004
Windows ADK for Windows 11, version 22H2
Windows ADK for Windows 11, version 23H2
Windows ADK for Windows 11, version 24H2
Windows ADK for Windows Server 2022

🔗 References (1)

advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25166